CVE-2017-3302

Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.

Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.

Crash in libmysqlclient.so in MariaDB 10.0.x through 10.0.29 (CVE-2017-3302).

Vulnerability in the MariaDB Server component of MariaDB (subcomponent: Server: MyISAM). Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MariaDB Server executes to compromise MariaDB Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MariaDB Server accessible data (CVE-2017-3313).

These are all security issues fixed in the libmariadbd-devel-10.6.4-2.1 package on the GA media of openSUSE Tumbleweed.

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mysql to version 5.5.55 fixes the following issues:

These security issues were fixed:

• CVE-2017-3308: Unspecified vulnerability in Server: DML (bsc#1034850)
• CVE-2017-3309: Unspecified vulnerability in Server: Optimizer (bsc#1034850)
• CVE-2017-3329: Unspecified vulnerability in Server: Thread (bsc#1034850)
• CVE-2017-3600: Unspecified vulnerability in Client: mysqldump (bsc#1034850)
• CVE-2017-3453: Unspecified vulnerability in Server: Optimizer (bsc#1034850)
• CVE-2017-3456: Unspecified vulnerability in Server: DML (bsc#1034850)
• CVE-2017-3463: Unspecified vulnerability in Server: Security (bsc#1034850)
• CVE-2017-3462: Unspecified vulnerability in Server: Security (bsc#1034850)
• CVE-2017-3461: Unspecified vulnerability in Server: Security (bsc#1034850)
• CVE-2017-3464: Unspecified vulnerability in Server: DDL (bsc#1034850)
• CVE-2017-3305: MySQL client sent authentication request unencrypted even if SSL was required (aka Ridddle) (bsc#1029396).
• CVE-2016-5483: Mysqldump failed to properly quote certain identifiers in SQL statements written to the dump output, allowing for execution of arbitrary commands (bsc#1029014)
• '--ssl-mode=REQUIRED' can be specified to require a secure connection (it fails if a secure connection cannot be obtained)

This non-security issue was fixed:

• Set the default umask to 077 in rc.mysql-multi [bsc#1020976]

For additional changes please see http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-55.html

Note: The issue tracked in bsc#1022428 and fixed in the last update was assigned CVE-2017-3302.

This update for mariadb fixes the following issues:

• update to MariaDB 10.0.30 GA
  • notable changes:
    • XtraDB updated to 5.6.35-80.0
    • TokuDB updated to 5.6.35-80.0
    • PCRE updated to 8.40
    • MDEV-11027: better InnoDB crash recovery progress reporting
    • MDEV-11520: improvements to how InnoDB data files are extended
    • Improvements to InnoDB startup/shutdown to make it more robust
    • MDEV-11233: fix for FULLTEXT index crash
    • MDEV-6143: MariaDB Linux binary tarballs will now always untar to directories that match their filename
  • release notes and changelog:
    • https://kb.askmonty.org/en/mariadb-10030-release-notes
    • https://kb.askmonty.org/en/mariadb-10030-changelog
  • fixes the following CVEs: CVE-2017-3313: unspecified vulnerability affecting the MyISAM component [bsc#1020890] CVE-2017-3302: Use after free in libmysqlclient.so [bsc#1022428]
• set the default umask to 077 in rc.mysql-multi [bsc#1020976]
• [bsc#1034911] - tracker bug
• increase build disk size from 10 GB to 13 GB in order to fix build for aarch64

This update for mariadb fixes the following issues:

• update to MariaDB 10.0.30 GA

  • notable changes:
    • XtraDB updated to 5.6.35-80.0
    • TokuDB updated to 5.6.35-80.0
    • PCRE updated to 8.40
    • MDEV-11027: better InnoDB crash recovery progress reporting
    • MDEV-11520: improvements to how InnoDB data files are extended
    • Improvements to InnoDB startup/shutdown to make it more robust
    • MDEV-11233: fix for FULLTEXT index crash
    • MDEV-6143: MariaDB Linux binary tarballs will now always untar to directories that match their filename
  • release notes and changelog:
    • https://kb.askmonty.org/en/mariadb-10030-release-notes
    • https://kb.askmonty.org/en/mariadb-10030-changelog
  • fixes the following CVEs: CVE-2017-3313: unspecified vulnerability affecting the MyISAM component [bsc#1020890] CVE-2017-3302: Use after free in libmysqlclient.so [bsc#1022428]

• set the default umask to 077 in mysql-systemd-helper [bsc#1020976]

• [bsc#1034911] - tracker bug

  • fixes also [bsc#1020868]

This MariaDB update to version 10.2.15 brings the following fixes and improvements.

Security issues:

• CVE-2018-2767: The embedded server library now supports SSL when connecting to remote servers (bsc#1088681).
• Collected CVEs fixes:
  • 10.2.15: CVE-2018-2786, CVE-2018-2759, CVE-2018-2777, CVE-2018-2810, CVE-2018-2782, CVE-2018-2784, CVE-2018-2787, CVE-2018-2766, CVE-2018-2755, CVE-2018-2819, CVE-2018-2817, CVE-2018-2761, CVE-2018-2781, CVE-2018-2771, CVE-2018-2813
  • 10.2.13: CVE-2018-2562, CVE-2018-2622, CVE-2018-2640, CVE-2018-2665, CVE-2018-2668, CVE-2018-2612
  • 10.2.10: CVE-2017-10378, CVE-2017-10268, CVE-2017-15365
  • 10.2.8: CVE-2017-3636, CVE-2017-3641, CVE-2017-3653, CVE-2017-10320, CVE-2017-10365, CVE-2017-10379, CVE-2017-10384, CVE-2017-10286, CVE-2017-3257
  • 10.2.6: CVE-2017-3308, CVE-2017-3309, CVE-2017-3453, CVE-2017-3456, CVE-2017-3464
  • 10.2.5: CVE-2017-3313, CVE-2017-3302

Bugfixes:

• bsc#1092544: Update suse_skipped_tests.list and add tests that are failing with GCC 8.
• bsc#1012075: MariaDB Test Suite issue with test sys_vars.secure_file_priv.test.
• bsc#1019948: mariadb even tumbleweed version is super old.
• bsc#1039034: no ODBC support in MariaDB Server.
• bsc#1041891: Make mariadb tests pass and exclude failures.
• bsc#1042632: Mariadb fails to build with openssl-1.1.
• bsc#1043328: Update mariadb in TW to 10.2 and drop comat with mysql.
• bsc#1047218: trackerbug: packages do not build reproducibly from including build time.
• bsc#1055165: mariadb build with cassandra enabled.
• bsc#1055268: MariaDB configurations are not overwritable.
• bsc#1058374: Use bind-address directive and SSL section settings in default my.cnf.
• bsc#1058729: MariaDB - mysql-test - connect.drop-open-error is failing (regression).
• bsc#1060110: The mariadb install script depends on hostname but does not require it.
• bsc#1062583: Stop using boost-devel.
• bsc#1067443: incomplete revert of the mariadb service rename.
• bsc#1068906: MariaDB: ALTER TABLE can't rename columns with CHECK constraints.
• bsc#1069401: Database failed apply with mariadb 10.2 : RuntimeError: Galera cluster did not start after 600 seconds.
• bsc#1080891: server:database/mariadb: up-streaming patches.
• bsc#1083087: Galera bootstrap failes work after MariaDB 10.2.13 upgrade.
• bsc#1082318: mariadb-connector-c.changes and xtrabackup need to use %doc instead of %license.

Release notes and changelog:

• https://mariadb.com/kb/en/library/mariadb-10215-release-notes
• https://mariadb.com/kb/en/library/mariadb-10215-changelog

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.5.55 in Ubuntu 14.04 LTS. Ubuntu 16.04 LTS, Ubuntu 16.10 and Ubuntu 17.04 have been updated to MySQL 5.7.18.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-55.html http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-18.html http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html